SAP Enterprise Portal vulnerabilities

4 CVEs affecting SAP Enterprise Portal, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2022-35224, published 2022-07-12.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2013-7367, published 2014-04-10. High severity, CVSS 7.5. EPSS: 1.5% chance of exploitation in the next 30 days. SAP Enterprise Portal does not properly restrict access to the Federation configuration pages, which allows remote attackers to gain privileges via unspecified vectors.
CVE-2013-7365, published 2014-04-10. Medium severity, CVSS 4.3. EPSS: 1.3% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in SAP Enterprise Portal allows remote attackers to inject arbitrary web script or HTML via unspecified parameters.
CVE-2017-10701, published 2017-09-29. Medium severity, CVSS 6.1. EPSS: 1.3% chance of exploitation in the next 30 days. Cross site scripting (XSS) vulnerability in SAP Enterprise Portal 7.50 allows remote attackers to inject arbitrary web script or HTML, aka SAP Security Notes 2469860, 2471209, and 2488516.
CVE-2022-35224, published 2022-07-12. Medium severity, CVSS 6.1. EPSS: 0.7% chance of exploitation in the next 30 days. SAP Enterprise Portal - versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. This attack can…